Granite Island Group Banner

Basic Countermeasures Equipment

1080H Telephone Analyzer

1080H - TELEPHONE ANALYZER

The 1080H is a completely self-contained battery operated unit designed to counter alterations to telephone or intercom systems. Features a high gain audio amplifier, carrier current receiver covering 10 to 700khz, automatic quadratone audio sweep generator for detection of single or multi-tone activated devices, time domain reflectometer (TDR) pulser (external oscilloscope required) for measuring distance to line discontinuities, optical (IR) probe for both primary and carrier modulation, modular input and output jacks to accept 4, 6 or 8 pin connectors.

Selector switch permits testing of all possible combinations of up to eight wires. Meter measures DC and AC voltage, current, resistance and line balance. Measures line balance to earth ground.

The 1080H is powered by a gel-cell battery (charger included). System supplied with main test unit, headset, connector-to-connector 8-wire cable, connector-to-connector 6-wire cable, connector-to-clip lead 8-wire cable, optical (IR) probe, battery charger, instructions and carrying case. The 1080H is specifically designed for modular system. A variety of adapters is available for use with the 1080H to interface with 50 (51) wire or 250 (251) wire or non-standard systems. Some of these adapters contain a 1000+ volt source for high voltage tests.

The 1080D/A digital telephone signal detector and demodulator is also available as an accessory to the 1080H. This unit has selectable Mu-law, A-law, CVSD and POEM modes.

The rechargeable gelcell battery in the 1080H has been partially charged prior to shipment. The first step is to fully charge the battery. This can be done while proceeding through this manual.

Remove the 1080H and charger from the carrying case. The charger is designed to operate from either 50 or 60 Hz but must be adjusted for 110 or 220 volts. The voltage selector switch is on the same side of the charger as the power prongs. Set the switch to match the power in your area. Plug the mini-plug output cable of the charger into the socket on the BACK of the 1080H. Plug the charger into the wall outlet. The red light emitting diode (LED) on the front of the 1080H below the word CHARGING will light indicating that charging is taking place. The initial charge can be made over a 6 to 8 hour time span. Never charge the battery for more than ten (10) hours at a time. To observe the battery voltage, rotate the VOLUME control slightly clockwise until the 1080H turns on. The meter will read 00.0 volts. Disregard the + or - sign. Press the RED button below the words BATTERY TEST. The meter will read the battery voltage. Charging is in order when the meter reads below 12.0 volts. A reading up to 13.8 volts is acceptable. Once the battery voltage is read, turn off the unit by rotating the VOLUME control counterclockwise to the OFF position.

NOTE: The front switches on the power supply have been preset on the 12 VDC and + position. Do not move the switches from these positions.

The front panel of the 1080H may look confusing at first glance but the switch functions break down into several basic tests. The following is a description of each control.

LINE PAIR: The two rotary switches in the upper right corner of the front panel provide every possible pair combination of the IN/OUT jacks located in the upper right corner of the analyzer. These two jacks are wired in parallel i.e. 1 to 1, 2 to 2, etc. The lettered positions are for measuring line balance between tip (T) (4) and ring (R) (5) and earth ground.

BALANCE C and D: These switches are used in conjunction with the LINE PAIR switch when measuring balance to earth ground.

MODE: This switch selects the main function of the analyzer. The AUDIO position monitors audio on any line pair. CARRIER selects the carrier current receiver to monitor any carrier signals which might occur on any line pair. TONE generates four swept audio tones which cover all possible DTMF frequencies or any combinations which occur from 200 to 4,000 Hz. TDR (Time Domain Reflectometry) generates an extremely fast rise time pulse at 12 volts P-P. Three pulse widths from .1uS and up are generated. The pulse width is selected by the TDR PULSE switch. S. short; M, medium and L, long.

The OPTICAL (IR) position switches to the IR PROBE jack.

IR PRIMARY/CARRIER: With the IR probe plugged into the IR PROBE jack, the MODE selector in the OPTICAL position and the IR switch in PRIMARY the probe monitors any IR activity in the vicinity of the analyzer. With the IR switch in CARRIER the probe is routed through the carrier current receiver which allows monitoring of any carrier signal in the vicinity of the analyzer.

The carrier current receiver consists of three controls CARRIER 10-100/100-700 KHz, TUNING LO-HI and GAIN zero through MAX.

The POWER/TONE indicator LED glows red when the power is turned on. This LED turns green when making a tone sweep of an active telephone line. The AUTO TONE SWEEP starts this process. This switch will be explained later.

The LOOP CURRENT switch places a 100 ohm 2 watt resistor across the pair selected by the LINE PAIR switches. The meter reads the voltage across this resistor, therefore, to convert the meter reading to milliamps move the decimal point two positions to the left.

The DC/AC METER switch converts the meter from DC to AC.

The RESISTANCE switch measures the DC resistance across the pair selected by the LINE PAIR switches. A reading of 00.0 indicates infinite resistance while a reading between 199.5 and over-range indicates zero ohms. A sample conversion chart appears later in the manual.

The jack on the front panel below the word HEADSET is for the headset or audio amplifier.

The two red binding posts on the back of the unit go to the external oscilloscope input. These posts are common to the position of the two LINE PAIR switches.

The green binding post on the rear panel is for the earth ground. This post can be run to the ground pin (NOT the neutral) of an AC power socket.

The two 8 pin sockets on the front upper right are, as mentioned before, wired pin for pin, Either one can be used for an input or output, The 6 pin socket in the front upper left is wired to the MIDDLE six pins of the 8 pin socket. Therefore, pin 1 of the 6 pin socket will occur at position 2 of the LINE PAIR. Pin 6 of the 6 pin socket will occur at position 7. This assures that the middle two wires of any cable are the red and green.

OPERATION

For initial startup set the controls as follows:

Remove the telephone plug from the wall and insert it into the 1080H. Use either the 6 or 8 pin jumper cable supplied and connect it between the wall socket and the 1080H. Insert the headset. Turn the VOLUME control to 9 o'clock. If the telephone has an 8 wire cable start with the LINE PAIR in 1,2. If the telephone has a 6 wire cable start with the LINE PAIR in 2,3.

Make a list or chart of the readings. Note any voltage and listen for room audio. If the voltage reading is not steady and fluctuates widely then it may be AC and not DC. Pull the DC/AC METER switch forward to read AC. Note. Then check and note 1-3; 1-4; 1-5,1-6 etc. Listening to each. Then go to 2-3, 2-4; 2-5 etc. Then 3-4; 3-5; 3-6 etc. until all possible pair combinations have been recorded and listened to.

Turn the MODE switch to CARRIER. Place the GAIN control at 12 o'clock and CARRIER switch at 10-100 KHz. Return the LINE PAIR switch to 1,2. With the volume turned up so an audible hiss can be heard rotate the TUNING control from LO to HI. Throw the CARRIER switch to 100-700 KHz and run the TUNING from HI to LO. Repeat this procedure on all possible combinations of the lines.

If, when measuring line voltage, which can be done in either the AUDIO or CARRIER positions of the MODE switch, the voltmeter indicated 00.0 volts then measure for resistance. See the instructions on how to measure resistance.

If an active telephone line is detected i.e. a voltmeter reading of 48-52 volts was obtained in one of the switch positions return to that position and run a tone sweep. Set the MODE switch on TONE. The POWER/TONE light will now be RED. Pull the AUTO TONE SWEEP switch forward and release. The POWER/TONE light will turn GREEN and remain GREEN for the duration of the sweep. Note your watch and allow 3 to 4 minutes for the tone sweep to go through at least one full cycle. If, during the sweep, a device is detected the light will turn from GREEN back to RED. Immediately switch to the AUDIO position and listen to the device. The only way to stop the sweep is to turn the MODE switch to either side of the TONE position.

Refer to the section on TIME DOMAIN REFLECTOMETRY for use of the TDR position of the MODE switch.

Plug the black IR probe into the IR PROBE jack. Turn the MODE switch to OPTICAL (IR). Adjust the volume for a slight hiss. Place the IR PRIMARY/CARRIER switch in PRIMARY. Turn off any florescent lights in the area. Pass the IR probe over the telephone while listening for room noise or conversation. The IR test operates independent of the LINE PAIR selector and other tests. Next, place the IR switch in CARRIER. Hold the probe steady over one portion of the phone and with the GAIN control at 12 O'clock, the CARRIER switch at 10-100 KHz rotate the TUNING control from LO to HI. Throw the CARRIER switch to 100-700 KHz and run the TUNING control from HI to LO. Move the probe a few inches and repeat. Do this process as many times as necessary until the entire telephone has been viewed.

When an active telephone line has been located (meter reads 48-52 volts), make a current test by depressing the LOOP CURRENT switch. Move the decimal point two positions to the left to obtain the actual current in AMPS or one position to the right to obtain the actual current in milliamps. This test is only valid when comparing at least 2 lines; preferably 3 or more.

Periodically test the battery voltage. When it drops below 12.0 recharge it for a few hours.

The headset is used for a variety of tests. It has long been held that the "feedback" technique produces more reliable results. To use the 1080H in this mode place the headset ON THE TELEPHONE ITSELF. Turn up the volume so an audible hiss can be heard. Run through the tests previously outlined. If an audio path exists a loud feedback squeal will be heard coming from the headset itself.

Maximum current drawn from the battery during any test is approximately 50 milliamps. The battery has a 1.8 amp hour rating or 1,800 milliamp hour. Therefore, the normal operating time between charges is 1,800/50 = 36 Hours.

As with any piece of electronic equipment, treat the 1080H with care. Excessive heat or moisture can degrade performance. If necessary, clean the unit periodically with a cotton or soft cloth lightly dampened with Windex or other window cleaner. Always turn the power switch to OFF when not in use.

MEASURING RESISTANCE

The internal calibration potentiometer (located on the right side of the meter as viewed through the front panel) has been preset at between 199.5 through over-range (a single 1 on the left side of the meter) for zero ohms. The ohmmeter circuit is powered by the 5 volt regulator which supplies the meter. This regulator can drift a few millivolts with temperature and this drift will affect the low resistance readings only. Below is a typical calibration chart for the ohmmeter.

Turn the power on. The meter will read 00.0. Set the LINE PAIR switches on the same number i.e. dead short. Pull the RESISTANCE switch forward. The meter should read between 199.5 and over-range (1 .). Set the LINE PAIR switches on the combination to be tested. Pull the RESISTANCE switch forward. Convert the meter reading to resistance using the chart above. NOTE. A resistance reading can only be made on a line which has NO DC or AC component.

USING THE TDR (TIME DOMAIN REFLECTOMETER)

The 1080H TDR pulser used in conjunction with an external oscilloscope will analyze and measure wire pairs or transmission lines. The TDR is essentially an echo ranging device. The unit generates a short very fast rise time pulse which travels down the wire pair at a speed determined by the velocity factor of the wire. A reflected pulse is generated when the output pulse hits a discontinuity. The distance to this discontinuity can be measured by simple calculation (keep a calculator handy).

The 1080H TDR generates three different pulse lengths. .1uSec for lines up to 2,500 feet, .2uSec for lines up to 10,000 feet and .5uSec for lines over 10,000 feet. The amplitude of the pulse is approximately the battery voltage i.e. 12V P-P.

The TDR must be used with either a battery operated or dual input AC or battery powered oscilloscope. If a battery powered scope is used connect it to the two RED terminal posts on the rear of the 1080H, Set the LINE PAIR switches on 4 and 5. Turn on the unit. Set the MODE switch on TDR and the TDR PULSE switch on S (Short). Adjust the scope for normal operation so the pulse can be seen. If the pulse is negative going reverse the test leads.

If a dual input scope is used connect the center lead of each test lead to the two RED posts on the rear of the 1080H. Adjust the B input on the scope for INVERTED (INV) input. Adjust the scope for normal operation and a positive going pulse. Set the horizontal position control so the leading edge of the pulse is at the left hand edge of the calibration marks on the screen. The rise time of the pulse is so fast that it may not be clearly seen. Advancing the intensity control momentarily will normally show the leading edge. Set the vertical position so the trace rides on the center line of the screen.

To become familiar with the TDR connect a known length of telephone line or zip cord to the RED terminals (100 feet will do). With the TDR PULSE switch on S and the scope horizontal sweep set at .1uSec per division and the far end of the test line open circuited the following positive going pulse will appear.

If the far end is short circuited the following negative going pulse will appear.

Measure the distance in microseconds to where the reflected pulse BEGINS TO LEAVE THE BASE LINE of the sweep. For 100 feet of wire with a velocity factor of .67 the pulse should occur at roughly .3uSec. Use the formula

Therefore, 1000 X .67 X .3 DIVIDED BY 2 = 100 FEET. The divide by two is necessary because it compensates for the fact that the pulse has to travel to the discontinuity and reflect back.

When making TDR measurements bear in mind that the length of the pulse itself can mask the very near measurements. The .1uSec pulse will mask the first 35 feet of cable, the .2uSec pulse will mask the first 70 feet and the .5uSec pulse 170 feet (this is called a dead zone). This does not mean that measurements can not be made at lengths below 35 feet. To test short cables use the LONG pulse and make measurements on the TOP OF THE PULSE PEDESTAL itself. When doing this it will be necessary to adjust the vertical position so the top of the pulse is on the center line.

When testing long lines it may be necessary to advance the vertical sensitivity to compensate for the loss of signal down-line.

Here are a few signatures of the return signal:

Helpful Hint: If the line under test is terminated by a telephone set or linemans handset place an audible beeper by the telephone handset or linemans handset. The reflected pulse as seen on the oscilloscope will pulse up and down at the rate of the beeper.

Formulas: TIME always in uSeconds. Vf means Velocity Factor

Unknown Length (L) = 1000 x VF x TIME

Unknown Velocity (VF) = (2 X LENGTH)/1000 x TIME

Unknown TIME = (2 X LENGTH)/1000 x VF

The TDR portion of the 1080H has an output impedance of roughly 450 ohms.

Read the first return signal. Pulses arriving back at the 1080H can again be reflected and travel back down the line only to be rereflected by the mismatch and returned to the 1080H as a second or ghost signal. Use care to identify these ghost signals. Multiple faults may or may not be observed. If the first fault encountered is severe, most or all of the pulse energy will be reflected, disguising other possible faults. After clearing the first indicated fault proceed to the second. Telephone cables by the nature of their construction produce displays that are not "clean" i.e. free from bumps.

Velocity factors (Vf) can vary from .5 to .8. If the Vf is unknown, start with .67.

The line under test can be attached to the two RED terminal posts on the rear of the 1080H or through the 8 pin plug to clip lead cable supplied. Insert the cable into either 8 pin jack. Set the LINE PAIR switches on position 4 (left switch) and 5 (right switch). The TDR pulse will occur at the RED and GREEN test clips. The clips can then be attached to the line under test. Test only lines which do not have a DC or AC component.

MEASURING LINE BALANCE

The 1080H can measure telephone line balance with respect to earth ground. This test gives a rough indication of the resistance of the line and helps in detecting series devices.

Turn on the 1080H. The meter will indicate 00.0 volts. Insert the 8 pin-to-clip lead test cable into either 8 pin jack. Only the RED and GREEN clips are used. Connect these clips to the telephone line under test. Make sure the other clips do not touch the RED and GREEN clips. Connect an earth ground to the GREEN or BLACK (color varies) terminal on the rear of the 1080H. Earth ground can be accessed through the ground socket of an AC outlet. A good ground is needed to make these tests valid. Do not use the neutral socket. Set BOTH of the LINE PAIR switches on A. Note the voltage, including polarity. Set BOTH switches on B and note the voltage, including the polarity. Set BOTH switches on C and press BALANCE switch C. Note the voltage. Set BOTH switches on D and press the BALANCE switch D. Note the voltage. This last reading must be converted into current (in AMPs) by dividing the reading by 5,000. Note the D figure in AMPS. If the voltmeter fluctuates between two numbers, i.e. .2 and .3, then recorded voltage should be .25.

  1. Add A and B
  2. Multiply C by 2
  3. Subtract step 1 from step 2
  4. Divide step 3 by the current (in Amps) obtained in D test.

The final calculation will give the approximate line balance. If the imbalance is 50 ohms or greater, a series device is indicated. Disregard the final polarity.

One of the two readings for test A and B will be in the vicinity of 1 volt or less. If, for example, the other higher reading was negative in polarity then the smaller one is normally positive. If the higher and lower readings were both positive or negative then a possible problem exists. A negative reading of more than .2 volts indicates parallel leakage. This could be water on the line, so test another line pair in the same bundle. A reading of .5 or more negative could indicate a parallel device. If the higher reading obtained in the A and B test was positive then the converse would be true.

EXAMPLE:

  1. A= -50.3, B= +00.1, C = -26.1, D= 39.1 VOLTS
  2. A + B = -50.2
  3. C x 2 = 52.2
  4. D / 5000 = .00782 AMPS
  5. C x 2 - (A+B) = 2.0
  6. 2.0 / .00782 = 255 OHMS IMBALANCE
This result would dictate further inspection of the line.

1080H TONE GENERATOR

Many users have found the tone generating section of the 1080H useful for other purposes such as wire tracing or placing a tone on a line which does not contain the necessary voltage to lock the tone generator ON. To accomplish this the AUTO TONE SWEEP switch has been changed from a "momentarily ON" to a "latch ON" type.

LINES WITH NORMAL ON-HOOK VOLTAGES

The OFF position of the AUTO TONE SWEEP switch is with the lever UP. Make sure there is 40 or more volts on the line under test. Place the MODE switch in the TONE position. Pull the AUTO TONE SWEEP switch DOWN. The indicator light will turn from RED to GREEN. When that occurs, push the lever of the switch back UP. The green light should remain ON and the tone sweep operating as described in the manual.

LINES WITHOUT NORMAL ON-HOOK VOLTAGES

Place the MODE switch on TONE. Pull the lever of the AUTO TONE SWEEP switch downward and leave it in that position for a continuous sweeping tone. IMPORTANT NOTE ABOUT CABLES

The cables supplied with the 1080H are made specifically for this unit. They are PIN-FOR-PIN types, i.e. pin 1 is pin 1 on both ends, pin 8 is pin 8 on both ends, etc. Standard telephone cables are rotated one half turn, i.e. pin 1 at one end is pin 8 at the other end, etc. DO NOT USE THIS TYPE OF CABLE. To make sure you have the correct cable, hold the plugs from each end of the cable side-by-side with the locking tab facing in the same direction. The same color wire should be showing through the plastic.

Advanced TSCM Signals Detection and Analysis
TSCM - Sweeping the Spectrum for Eavesdropping Devices


| Home | What is TSCM | Types of Bugs | Warning Signs You're Bugged |
| How To Behave if Bugged | TSCM Threat Levels | How To Engage a TSCM Firm |
| Qualifications | TSCM Protocol | Bug Frequencies | Phone Taps and Bugging |
| Signal Analysis | TDR Analysis | TDR Tutorial | Wiretapping | Training | Tools |
| Equipment | OSC-5000 | Kaiser | Riser Bond | Avcom | Search Rcvrs |
| Outside Links | Recommended TSCM Books | TSCM Reference Library |
| Recommended U.S. TSCM Firms | TSCM-L Mailing List |

-----------------------

Copyright ©2002, Granite Island Group